[meta-oe][PATCH v2] cve-update-db: do_populate_cve_db depends on do_fetch

[meta-oe][PATCH v2] cve-update-db: do_populate_cve_db depends on do_fetch

[Pierre Le Magourou]

From: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com>

To be able to populate NVD database on a fetchall
(bitbake <image> --run-all=fetch), set the do_populate_cve_db task to be
executed before do_fetch.

Signed-off-by: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com>
---
 meta/recipes-core/meta/cve-update-db.bb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/meta/cve-update-db.bb b/meta/recipes-core/meta/cve-update-db.bb
index 522fd23807..e096db7717 100644
--- a/meta/recipes-core/meta/cve-update-db.bb
+++ b/meta/recipes-core/meta/cve-update-db.bb
@@ -4,9 +4,12 @@ LICENSE = "MIT"
 INHIBIT_DEFAULT_DEPS = "1"
 PACKAGES = ""
 
+CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK"
+CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvd-json.db"
+CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check"
+
 inherit nopackages
 
-deltask do_fetch
 deltask do_unpack
 deltask do_patch
 deltask do_configure
@@ -115,7 +118,7 @@ def update_db(c, json_filename):
 
 
 
-addtask do_populate_cve_db before do_cve_check
+addtask do_populate_cve_db before do_fetch
 do_populate_cve_db[nostamp] = "1"
 
 EXCLUDE_FROM_WORLD = "1"
-- 
2.11.0

Re: [meta-oe][PATCH v2] cve-update-db: do_populate_cve_db depends on do_fetch

[Richard Purdie]

On Thu, 2019-06-27 at 11:11 +0200, Pierre Le Magourou wrote:
> From: Pierre Le Magourou <pierre.lemagourou@softbankrobotics.com>
> 
> To be able to populate NVD database on a fetchall
> (bitbake <image> --run-all=fetch), set the do_populate_cve_db task to
> be
> executed before do_fetch.
> 
> Signed-off-by: Pierre Le Magourou <
> pierre.lemagourou@softbankrobotics.com>
> ---
>  meta/recipes-core/meta/cve-update-db.bb | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
Thanks for the fast turnaround on the patch. This seems to move the
problem to:

https://autobuilder.yoctoproject.org/typhoon/#/builders/23/builds/990/steps/7/logs/step1b

:(

Perhaps we need to skip the recipe if the class isn't enabled? Is that
the reason its failing like this?

Cheers,

Richard

Re: [meta-oe][PATCH v2] cve-update-db: do_populate_cve_db depends on do_fetch

[Pierre Le Magourou]

> Thanks for the fast turnaround on the patch. This seems to move the
> problem to:
>
> https://autobuilder.yoctoproject.org/typhoon/#/builders/23/builds/990/steps/7/logs/step1b
>
> :(
>
> Perhaps we need to skip the recipe if the class isn't enabled? Is that
> the reason its failing like this?

It is failing with 'sqlite3.OperationalError' exception when opening
the sqlite3 db file.
I reproduced the bug by removing the ${DL_DIR}/CVE_CHECK directory

I forgot to check that the ${DL_DIR}/CVE_CHECK directory exists before
creating sqlite db file in it.
I'll send a v3 patch to fix this.

Pierre